National Care Service: privacy notice

This privacy notice explains your rights under the UK General Data Protection Regulation (UK GDPR). It tells you how we will look after and use your personal data.

Who we are

We are the Directorate for Social Care and National Care Service Development within the Scottish Government. We are the devolved government for Scotland and our head office is located at St Andrews House, Regent Road, Edinburgh, EH1 3DG.

The Scottish Government has committed to establishing a National Care Service (NCS) by the end of 2026. The NCS will be designed with people’s experience and needs at its heart and to achieve this. Our co-design events are inviting people with experience of accessing or delivering social care to take part in co-design activities where their experiences and ideas for how social care can be improved will be discussed.

Why we are asking you for information and what will we do with it

So that we can make sure the co-design work we are undertaking involves different kinds of people who have different kinds of experiences of social care we are asking you for some information about:

• you
• others within your household
• your experiences of accessing and/or delivering social care support

Some of this will be sensitive personal data about you that is given greater protection under Data Protection legislation. The legislation calls this special category information. This is things such as information relating to your health, sexuality, religion and gender.

Gathering this data will allow us to plan future events and where necessary target recruitment of participants to particular groups that have been under-represented.

Any information you share with us is entirely voluntary and you do not have to provide it.

Our legal basis for using your personal data

The legal basis for processing this data is Article 6(1)(e) of the GDPR regulations: ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’. This is also known as ‘public task’.

We are processing your personal data as it is necessary for the performance of a task in the public interest under s1A of the National Health Service (Scotland) Act 1978. This power enables the Scottish Ministers to do anything they consider likely to assist in discharging their duty to promote the improvement of the physical and mental health of the people of Scotland. This includes undertaking research and design with the public and organisations to understand their experiences of Health and Social Care services for informing the future design of the National Care Service.

We are using an online survey website called Microsoft Forms – who process personal data on our behalf and under our direction.

You can read the Microsoft Forms privacy notice on their website::  Privacy and compliance - Microsoft Support

We will move your data from Microsoft Forms to the Scottish Government’s own data stores within 3 months.

How long we will keep your personal data

 We will keep your personal information for 2 years so we can:

• Find out who we have been able to speak to through co-design and identify under-represented groups that we should work with in the future.
• Publish anonymised statistics about who we have engaged with through co-design

If you have given information about other people

If you are giving us information on somebody else’s behalf, please make sure that:

• you have told them that you are providing their information to the Scottish Government
• inform them of this privacy notice

How we protect your data

We have a duty to protect your personal data.

We will store your personal data in access-restricted folders with only a small number of individuals from the following groups of Scottish Government staff allowed to access them:

• select members of the National Care Service Programme team in Scottish Government
• select members of the Office of the Chief Designer Division in Scottish Government

We will remove your data from Microsoft Forms within 3 months and store it on secure Scottish government digital folders. It will be deleted from Scottish Government folders within 2 years.

Your data protection rights

Data protection law gives you certain rights that you may exercise in respect of your own personal information. As stated above, the legal basis for processing your personal data is Article 6(1)(e) of the GDPR regulations, known as ‘public task’. You therefore have the following rights.

1. The right to be informed about the collection and use of your personal data.
2. The right of access to your personal data. You can request a copy of personal information we hold about you, by making a subject access request. This right always applies. There are some exemptions, which means you may not always receive all the information we process. We have published further information on this.
3. The right to rectification. You can ask us to update our records if you believe that the data we hold is inaccurate or incomplete.
4. The right to restrict processing. You can ask that we stop or restrict the processing of your information in certain circumstances.
5. The right to object to the processing of your personal data in certain circumstances.
6. Rights related to automated decision making including profiling.

You are not required to pay any charge for exercising your rights. We have one month to respond to you. Please contact us at dpa@gov.scot if you wish to make a request or contact our Central Enquires Unit on 0300 244 4000.

In addition, if you believe that the data we hold is inaccurate or incomplete you can ask us to update our records by emailing NCSCommunications@gov.scot

For more information on the rights you have over how your personal data is handled, please visit Your data matters | ICO

Data Controller

The Scottish Government is the Data Controller. This means that it is the main decision-maker when it comes to how your personal information is handled and how it is kept safe

Contact details:
St Andrew's House
Regent Road
Edinburgh
EH1 3DG
E mail: ceu@gov.scot
Tel: 0131 244 4000

Data Processor

Microsoft Forms survey platform will process your personal data on behalf of the Data Controller (the Scottish Government).

How to complain

If you are dissatisfied with the way we handle your personal data, you can raise your concerns with our Data Protection Officer in the first instance, by:. You can do this by emailing: DataProtectionOfficer@gov.scot or writing to:

Data Protection Officer
Victoria Quay
Commercial Street
Edinburgh
EH6 6QQ

If you feel we have been unable, or unwilling to resolve your complaint, you have the right to lodge a complaint with the Regulator for data protection in the UK, the Information Commissioner's Office (ICO):
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone
08456 30 60 60
https://ico.org.uk/concerns/handling/
If you would like this privacy notice in easy read, please contact: LEEP@gov.scot.